SSH公钥认证
了解密钥对的创建和使用，掌握免password远程登录和远程操作
二、实验环境
本地主机 rh1: 192.168.233.3/24
远程主机 rh2: 192.168.233.4/24
在putty上。以用户yanji登录rh1。
三、实验过程（写出屏幕上的输出，必要时作出评述或解释）
1、创建密钥对
主机rh1。用户yanji。
$zh
$cd
$mkdir -pm 700 .ssh
$ssh-keygen -f .ssh/id_dsa -t dsa
[yanji@localhost yanji]$ zh
[yanji@localhost yanji]$ cd
[yanji@localhost yanji]$ mkdir -pm 700 .ssh
[yanji@localhost yanji]$ ssh-keygen -f .ssh/id_dsa -t dsa
Generating public/private dsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in .ssh/id_dsa.
Your public key has been saved in .ssh/id_dsa.pub.
The key fingerprint is:
19:0a:c1:03:f5:5a:d6:1f:fe:ba:2b:bb:8a:98:a9:2c yanji@localhost.localdomain
口令串passphrase为空。查看产生的密钥对：
私钥：
$cd
$cat .ssh/id_dsa
[yanji@localhost yanji]$ cd
[yanji@localhost yanji]$ cat .ssh/id_dsa
-----BEGIN DSA PRIVATE KEY-----
MIIBuwIBAAKBgQCg2+/fn+RwjHYUDYA0hczgX/dRf0ljszAUeopo4QpF4K+WhmRM
fNsfdigzCA9Y7/aMeZ5olT69KfaKmEGJs2apvpcdtPdazHQgU3CyGneQly5USP0K
xwtrsF6SyllrDzS42JJrEgnTAvn3ix1KSy8mbZjfaCzFD3lDuRrk9kxWTQIVALcY
qQDmMAmq4OgxURdDvIuO0GPzAoGAA0ANpEGkECDi25QENHUSXwLyKEdcCwppE7VT
XgLJ+qZNnLND1xSPuJi4oD1H0XpuG+5tyoTfrizoEOBZfKfSSHwVPnSQKzB11o4r
Nn2H1pj6hX1nvCeNYHVZ/C5Y8XhfLK+CzWZy+avG17PrNHWSPoItMhP0/Oq7HW2T
LyFGWBsCgYBLGHGc7AOIUeuiBNMiQxLX8itbhxGtK2dNWJYb6CL8D2t3j7loEDGY
6y5EXhNcajIEDB7IBf0d7qYiqx8sBcf1+cgNOvJhySSe33XQNeDteJuQoNPOMcYu
uivB5IezWcO08+lfov4RqMdJQpJ+dcRE1i1s5sbxepQGU0jtroDKIAIVAIWu/kwt
gTQnfm3OPTAErqESbbb7
-----END DSA PRIVATE KEY-----
公钥：
$cat .ssh/id_dsa.pub
[yanji@localhost yanji]$ cat .ssh/id_dsa.pub
ssh-dss AAAAB3NzaC1kc3MAAACBAKDb79+f5HCMdhQNgDSFzOBf91F/SWOzMBR6imjhCkXgr5aGZEx82x92KDMID1jv9ox5nmiVPr0p9oqYQYmzZqm+lx2091rMdCBTcLIad5CXLlRI/QrHC2uwXpLKWWsPNLjYkmsSCdMC+feLHUpLLyZtmN9oLMUPeUO5GuT2TFZNAAAAFQC3GKkA5jAJquDoMVEXQ7yLjtBj8wAAAIADQA2kQaQQIOLblAQ0dRJfAvIoR1wLCmkTtVNeAsn6pk2cs0PXFI+4mLigPUfRem4b7m3KhN+uLOgQ4Fl8p9JIfBU+dJArMHXWjis2fYfWmPqFfWe8J41gdVn8LljxeF8sr4LNZnL5q8bXs+s0dZI+gi0yE/T86rsdbZMvIUZYGwAAAIBLGHGc7AOIUeuiBNMiQxLX8itbhxGtK2dNWJYb6CL8D2t3j7loEDGY6y5EXhNcajIEDB7IBf0d7qYiqx8sBcf1+cgNOvJhySSe33XQNeDteJuQoNPOMcYuuivB5IezWcO08+lfov4RqMdJQpJ+dcRE1i1s5sbxepQGU0jtroDKIA==
yanji@localhost.localdomain
[yanji@localhost yanji]$
2、上传公钥到rh2
主机rh1，用户yanji。
$cd
$scp .ssh/id_dsa.pub root@192.168.233.4:.
[yanji@localhost yanji]$ scp .ssh/id_dsa.pub root@192.168.233.4:.
root@192.168.233.4's password:
id_dsa.pub 100% |*****************************| 617 00:00
3、远程登录rh2
$主机rh1，用户yanji。
$ssh root@192.168.223.4
...
#
[yanji@localhost yanji]$ ssh root@192.168.233.4
root@192.168.233.4's password:
Last login: Fri Jan 30 15:08:33 2015 from 192.168.233.1
如今到了rh2。
4、加入yanji的公钥到授权密钥文件
#mkdir -pm 600 .ssh
#cat id_dsa.pub >> .ssh/authorized_keys
#chmod 600 .ssh/authorized_keys
#exit
$
[root@localhost root]# mkdir -pm 600 .ssh
[root@localhost root]# cat id_dsa.pub >> .ssh/authorized_keys [root@localhost root]# chmod 600 .ssh/authorized_keys
[root@localhost root]# exit
[yanji@localhost yanji]$
如今回到了rh1。
5、免password远程登录
主机rh1,用户yanji。
远程登录rh2，创建文件poem1后退出。
$ssh root@192.168.233.4
#zh
#cat > poem1
唧唧复唧唧
木兰当户织
不闻机杼声
惟闻女叹息
#exit
$
[yanji@localhost yanji]$ ssh root@192.168.233.4
Last login: Fri Jan 30 15:13:39 2015 from 192.168.233.3
[root@localhost root]# zh
[root@localhost root]# cat > poem1
唧唧复唧唧
木兰当户织
不闻机杼声
惟闻女叹息
[root@localhost root]# exit
logout
Connection to 192.168.233.4 closed.
[yanji@localhost yanji]$
如今又回到了rh1
6、远程复制
主机rh1，用户yanji
$ls
$scp root@192.168.233.4:poem1 .
$ls
$cat poem1
[yanji@localhost yanji]$ ls
01
[yanji@localhost yanji]$ scp root@192.168.233.4:poem1 .
poem1 100% |********************************| 64 00:00
[yanji@localhost yanji]$ ls
01 poem1
[yanji@localhost yanji]$ cat poem1
唧唧复唧唧
木兰当户织
不闻机杼声
惟闻女叹息
6、远程操作（远程运行命令）
主机rh1,用户yanji。
$ssh root@192.168.233.4 ls -l
$ssh root@192.168.233.4 "echo '(木兰诗片段)' >> poem1"
$ssh root@192.168.233.4 "cat poem1"
[yanji@localhost yanji]$ ssh root@192.168.233.4 ls -l
total 160
-rw-r--r-- 1 root root 1837 Nov 9 03:51 anaconda-ks.cfg
-rw-r--r-- 1 root root 0 Nov 21 13:41 backup
drwxr-xr-x 2 root root 4096 Nov 16 01:44 bin
drwxr-xr-x 2 root root 4096 Nov 21 07:48 c
-rw-r--r-- 1 root root 49 Nov 21 13:52 cron.txt
-rw-r--r-- 1 root root 182 Nov 21 05:53 dd
-rw-r--r-- 1 root root 12 Nov 21 08:01 ee
-rw-r--r-- 1 root root 50 Nov 16 01:41 file
-rw-r--r-- 1 root root 0 Nov 21 01:53 file1
-rw-r--r-- 1 root root 0 Nov 21 01:53 file4
-rw-r--r-- 1 root root 0 Nov 21 01:53 file44
drwxr-xr-x 2 root root 4096 Nov 21 02:51 file55
drwxr-xr-x 2 root root 4096 Nov 21 01:57 file554
-rwxr-xr-x 1 root root 11816 Nov 16 02:09 hexagon
-rw-r--r-- 1 root root 339 Nov 16 02:08 hexagon.c
-rw-r--r-- 1 root root 460 Nov 16 02:10 hexagon.dat
-rw-r--r-- 1 root root 1696 Nov 16 01:52 hexagon.o
-rw-r--r-- 1 root root 151 Nov 16 02:12 hexagon.p
-rw-r--r-- 1 root root 617 Jan 30 15:10 id_dsa.pub
-rw-r--r-- 1 root root 12 Nov 21 08:03 info
-rw-r--r-- 1 root root 19564 Nov 9 03:50 install.log
-rw-r--r-- 1 root root 4268 Nov 9 03:50 install.log.syslog
-rwxr-xr-x 1 root root 103 Nov 21 15:22 l1
-rwxr-xr-x 1 root root 137 Nov 21 08:08 let
-rw-r--r-- 1 root root 3 Nov 14 16:15 list.o
-rwxr-xr-x 1 root root 104 Nov 14 12:10 mean
drwxr-xr-x 2 root root 4096 Nov 12 08:12 mmmmm
-rw-r--r-- 1 root root 762 Nov 21 07:44 named.conf
-rw-r--r-- 1 root root 104 Nov 11 07:04 nn
drwxr-xr-x 2 root root 4096 Nov 21 04:01 p
-rw-r--r-- 1 root root 64 Jan 30 15:20 poem1
drwxr-xr-x 2 root root 4096 Nov 21 04:01 pp
-rwxr-xr-x 1 root root 133 Nov 21 05:24 shell
-rw-r--r-- 1 root root 29 Nov 21 14:00 time
-rw-r--r-- 1 root root 9767 Nov 21 15:54 xx.tar.gz
[yanji@localhost yanji]$ ssh root@192.168.233.4 "echo '(木兰诗片段)' >> poem1"
[yanji@localhost yanji]$ ssh root@192.168.233.4 "cat poem1"
唧唧复唧唧
木兰当户织
不闻机杼声
惟闻女叹息
(木兰诗片段)
四、实验的体会
知道部分远程操控的操作和免password登录。自己还是那么粗心，一開始就打错一个字母，搞了非常久才发现。
